### Author:  [@Arnold](https://meta.discourse.org/u/Arnold)
#### Post date: [June 20, 2024, 12:42pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/1 "2024-06-20T12:42:40Z")
Hi Discourse Community,
usually when I run a webserver I will use this script in combination with cloudflare:
[https://github.com/Paul-Reed/cloudflare-ufw](https://github.com/Paul-Reed/cloudflare-ufw)
Im not a fan of a public backend IP since it can easily be found with Censys or similar even if its behind cloudflare reverse proxy.
I tried many ways to reproduce this with discourse, but it just won’t work.
I also tried this with IPTables:
>
Got somebody a similar solution working with discourse?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 20, 2024, 2:49pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/2 "2024-06-20T14:49:58Z")
Docker does stuff that breaks IP tables. You should Google that, I think.
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 20, 2024, 7:27pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/3 "2024-06-20T19:27:59Z")
I also agree with him, wish discourse works like this: if you visit direct ip you see a white screen or literally anything, drop the connection without a domain idk
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 20, 2024, 7:31pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/4 "2024-06-20T19:31:41Z")
I think you could change the NGINX config so that it would accept connections only from cloudflare.
You could also change it so that it would not redirect the bare IP, but I’m not sure that would increase security by much.
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 20, 2024, 7:35pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/5 "2024-06-20T19:35:04Z")
> [@pfaffman](#):
>
> not sure that would increase security by much.
It sure would, prevents ip being found by dns , censys/shodan etc.
I tried googling how to only allow cf but not much help, I don’t remember what the outcome was, plus if only allowing cf ip’s and im using the cf config to get real ip, would that mess it up? I’d really love if there was a doc.
and I don’t know how to edit the nginx config, when I enter app, can’t edit anything, im a bit of a noob sorry lol
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 20, 2024, 7:44pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/6 "2024-06-20T19:44:31Z")
The web template adds a redirect for the IP (and any connection), so you could un-do that bit.
[Allowing Cloudflare IP addresses only in Nginx | inDev. Journal](https://frankindev.com/2020/11/18/allow-cloudflare-only-in-nginx/) describes how to allow only cloudflare IPs. Figuring out how to get a template to do that is a bit of work for someone who understands the templates, but it should be possible.
> [@Genisis](#):
>
> if only allowing cf ip’s and im using the cf config to get real ip, would that mess it up? I
No. The real address is in another header.
> [@pfaffman](#):
>
> Docker does stuff that breaks IP tables. You should Google that, I think.
> **[Google Search](https://www.google.com/search?q=iptables+docker&oq=iptables+docker)**
and the first hit ([Packet filtering and firewalls | Docker Docs](https://docs.docker.com/network/packet-filtering-firewalls/)) describes
> **[Packet filtering and firewalls](https://docs.docker.com/engine/network/packet-filtering-firewalls/)**
>
> How Docker works with packet filtering, iptables, and firewalls
> [@](#):
>
> By default, all external source IPs are allowed to connect to the Docker host. To allow only a specific IP or network to access the containers, insert a negated rule at the top of the `DOCKER-USER` filter chain. For example, the following rule restricts external access from all IP addresses except `192.168.1.1`
So you’d need to change the cloudflare script accordingly.
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 20, 2024, 7:49pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/7 "2024-06-20T19:49:05Z")
this is way above my brain power, I do appreciate your response, will read those docs soon, hope someone sees this who have time and could write something up, ive seen quite a few posts here already regarding this issue
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 20, 2024, 7:54pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/8 "2024-06-20T19:54:29Z")
Unless you run a community that has a history of DDOS attacks for some particular reason and you expect more, I’d not use any more of your brain on it. It would take me an hour or three to figure it out and document it. I have been setting up Discourse for people for a long time and have never worked with someone for whom DDOS was an actual problem.
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 20, 2024, 7:56pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/9 "2024-06-20T19:56:53Z")
I do run a forum thats been targeted before, thanks to cf they helped (using pro plan), but it would be great to “prepare” for it before it happens, gotta have the best security right? but yeah I get it, its a lot of work.
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [June 20, 2024, 7:58pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/10 "2024-06-20T19:58:20Z")
I think ChatGPT and the script from the first post could solve it.
---
### Author:  [@Genisis](https://meta.discourse.org/u/Genisis)
#### Post date: [June 20, 2024, 7:59pm UTC](https://meta.discourse.org/t/iptables-and-ufw-problems/312878/11 "2024-06-20T19:59:59Z")
I see, hopefully OP can attempt that, I’ll have a look later too, appreciate your help